Cybersecurity firm Morphisec has detected exploitation attempts using critical PHP2Shell flaws against Windows servers, whereas previous reports of the vulnerability only involved Linux systems. Morphisec reported that it blocked a reverse shell attack on a customer’s IIS server as attackers expanded the scope of their campaign.
The vulnerability presents a wide attack surface, with a survey showing that 10k Qualys customers alone run 110M PHP installations on end-of-life versions. While the first validated use of the exploit was observed on honeypot servers on Oct 26, researchers from Wiz and other security monitors have noted that many subsequent exploitation attempts have failed to succeed.
